fix(auth): reject placeholder mobile numbers

auth/src/main/java/com/baiyue/auth/dto/AccountManagementDtos.java

@@ -22,7 +22,7 @@ public final class AccountManagementDtos {
             String newPassword) { }
     public record CreateAccountRequest(@NotNull Long accountId,
                                        @NotBlank @Pattern(regexp = "^[A-Za-z][A-Za-z0-9_.@-]{3,63}$") String username,
-                                       @Pattern(regexp = "^1\\d{10}$") String phone,
+                                       @Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
                                        @NotBlank @Size(min = 8, max = 64)
                                        @Pattern(regexp = "^(?=.*[A-Za-z])(?=.*\\d).+$", message = "密码必须同时包含字母和数字") String password,
                                        @NotBlank String displayName, @NotNull Long tenantId,
@@ -42,10 +42,10 @@ public final class AccountManagementDtos {
     }
     public record ChangeLoginIdentifiersRequest(
             @NotBlank @Pattern(regexp = "^[A-Za-z][A-Za-z0-9_.@-]{3,63}$") String username,
-            @NotBlank @Pattern(regexp = "^1\\d{10}$") String phone,
+            @NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
             @NotBlank String currentPassword) { }
     public record UpdateAccountPhoneRequest(
-            @NotBlank @Pattern(regexp = "^1\\d{10}$") String phone) { }
+            @NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String phone) { }
     public record UpdateAccountProfileRequest(@NotBlank @Size(max = 64) String displayName) { }
     public record UpdateAccountStatusRequest(@NotBlank String status) { }
     public record RevokeAccountSessionsRequest(

auth/src/main/java/com/baiyue/auth/dto/MerchantRegisterRequest.java

@@ -13,7 +13,7 @@ public record MerchantRegisterRequest(
         @NotBlank @Size(max = 64) String displayName,
         @NotBlank @Size(max = 128) String companyName,
         @NotBlank @Size(max = 64) String legalPerson,
-        @NotBlank @Pattern(regexp = "^1\\d{10}$") String legalPhone,
+        @NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String legalPhone,
         @Email @Size(max = 128) String contactEmail,
         @Size(min = 2, max = 2) String countryCode,
         @Size(max = 255) String address

auth/src/main/java/com/baiyue/auth/service/AuthService.java

@@ -61,7 +61,7 @@ public class AuthService {
         description = "User login / 用户登录", captureAfter = false)
     public TokenResponse login(LoginRequest request) {
         String loginId = request.loginId().trim();
-        AuthAccount account = loginId.matches("^1\\d{10}$")
+        AuthAccount account = loginId.matches("^1[3-9]\\d{9}$")
                 ? accountRepository.findByPhone(loginId)
                 : accountRepository.findByUsername(loginId);
         if (account == null) throw invalidCredentials();

auth/src/main/resources/db/auth-login-identifiers.sql

@@ -23,14 +23,14 @@ BEGIN
   IF EXISTS (
       SELECT user.phone
         FROM baiyue_iam.iam_user user
-       WHERE user.deleted = 0 AND user.phone REGEXP '^1[0-9]{10}$'
+       WHERE user.deleted = 0 AND user.phone REGEXP '^1[3-9][0-9]{9}$'
        GROUP BY user.phone HAVING COUNT(DISTINCT user.auth_user_id) > 1) THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 'IAM 存在重复手机号，禁止建立 Auth 唯一登录索引';
   END IF;
   UPDATE auth_account account
   JOIN baiyue_iam.iam_user user ON user.auth_user_id = account.id AND user.deleted = 0
      SET account.phone = user.phone
-   WHERE account.phone IS NULL AND user.phone REGEXP '^1[0-9]{10}$';
+   WHERE account.phone IS NULL AND user.phone REGEXP '^1[3-9][0-9]{9}$';
   IF NOT EXISTS (
       SELECT 1 FROM information_schema.statistics
        WHERE table_schema = 'baiyue_auth' AND table_name = 'auth_account'